CVE-2026-33718

OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the "getgitdiff" method at "openhands/runtime/utils/githandler.py:134". The "path" parameter from the "/api/conversations/conversationid/git/diff" API endpoint is passed...

OpenHands operating system command injection vulnerability

OpenHands is an open-source AI-driven intelligent agent development platform. Version 1.5.0 of OpenHands contains a vulnerability related to operating system command injection. This vulnerability stems from the getgitdiff method, which allows for command injection, potentially enabling...

CVE-2026-33718: Improper Neutralization of Special Elements used in an OS Command

OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the getgitdiff method at openhands/runtime/utils/githandler.py:134. The path parameter from the /api/conversations/conversationid/git/diff API endpoint is passed unsanitized to ...